Generative AI Model Protection using Sidecars

Abstract

Data characterizing a prompt for ingestion by a first generative AI model is received. This received data is input into a second GenAI model to result in a second output. The first GenAI model is a different (e.g., fine-tuned, unrelated aligned model, etc.) version of the second GenAI model. When the second output indicates that guardrails associated with the second GenAI model have been triggered, one or more remediation actions are initiated. Related apparatus, systems, techniques and articles are also described.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 receiving, from a requestor, data characterizing a prompt for ingestion by a first generative artificial intelligence (GenAI) model;   redirecting the received data before it is ingested by the first GenAI model into a second GenAI model to receive a second output, the first GenAI model being different than the second GenAI model;   determining whether the second output indicates that guardrails associated with the second GenAI model have been triggered;   inputting the prompt into the first GenAI model in response to the determination that the second output indicates that guardrails associated with the second GenAI model have not been triggered to result in a first output and returning the first output to the requestor; and   initiating one or more remediation actions in response to the determination that the second output indicates that the guardrails associated with the second GenAI model have been triggered.   
     
     
         2 . The method of  claim 1 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model. 
     
     
         3 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 returning the second output to the requestor.   
     
     
         4 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 preventing the prompt from being input into the first GenAI model.   
     
     
         5 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 flagging the prompt as being malicious for quality assurance.   
     
     
         6 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 modifying the prompt to be benign.   
     
     
         7 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 blocking an internet protocol (IP) address of the requestor.   
     
     
         8 . The method of  claim 7 , wherein the initiated one or more remediation actions further comprise:
 blocking one or more of a media access control (MAC) address or a session identifier of the requester.   
     
     
         9 . The method of  claim 1 , wherein the initiated one or more remediation actions comprise:
 causing subsequent prompts from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester of the prompt to be modified prior to input into the first GenAI model.   
     
     
         10 . The method of  claim 1 , wherein both of the first GenAI model and the second GenAI model comprise a large language model, and the first GenAI model is derived from the second GenAI model. 
     
     
         11 . The method of  claim 10 , wherein the first GenAI model is a fine-tuned version of the second GenAI model. 
     
     
         12 . The method of  claim 1 , wherein the first GenAI model is an unaligned model and the second GenAI model is an aligned, unrelated model. 
     
     
         13 . A computer-implemented method comprising:
 receiving, from a requestor, data characterizing a prompt for ingestion by a first generative artificial intelligence (GenAI) model executing in a model environment;   redirecting the received data from the model environment to a monitoring environment;   inputting the received data into a second GenAI model executing in the model environment to result in a second output;   determining whether the second output indicates that guardrails associated with the second GenAI model have been triggered;   inputting the received data into the first GenAI model when it is determined that the second output indicates that guardrails associated with the second GenAI model have not been triggered to result in a first output and returning the first output to the requestor; and   initiating one or more remediation actions when is determined that the second output indicates that the guardrails associated with the second GenAI model have been triggered.   
     
     
         14 . The method of  claim 13 , wherein the data is received from a proxy intercepting inputs to the first GenAI model, the proxy being executed in a model environment of the first GenAI model, the second GenAI model being executed in a monitoring environment separate and distinct from the model environment. 
     
     
         15 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 returning the second output to the requestor.   
     
     
         16 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 preventing the prompt from being input into the first GenAI model.   
     
     
         17 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 flagging the prompt as being malicious for quality assurance.   
     
     
         18 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 modifying the prompt to be benign.   
     
     
         19 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 blocking an internet protocol (IP) address of the requestor.   
     
     
         20 . The method of  claim 19 , wherein the initiated one or more remediation actions further comprise:
 blocking one or more of a media access control (MAC) address or a session identifier of the requester.   
     
     
         21 . The method of  claim 13 , wherein the initiated one or more remediation actions comprise:
 causing subsequent prompts from an entity identified by one or more of an internet protocol (IP) address, a media access control (MAC) address, or a session identifier of the requester of the prompt to be modified prior to input into the first GenAI model.   
     
     
         22 . The method of  claim 13 , wherein both of the first GenAI model and the second GenAI model comprise a large language model. 
     
     
         23 . The method of  claim 13 , wherein the first GenAI model is a fine-tuned version of the second GenAI model. 
     
     
         24 . The method of  claim 13 , wherein the first GenAI model is an unaligned model and the second GenAI model is an aligned, unrelated model.